WASHINGTON–Business email compromise scams, which often target executives at financial institutions and other companies, saw a sharp increase in 2019, according to a new FBI Internet Crime Report.
The FBI said cybercrime resulted in $3.5-billion in losses in the U.S. last year, with the biggest uptick in business email compromise attacks, also known as BEC attacks.
As CUToday.info has reported on numerous occasions, including here, NCUA and other authorities have repeatedly cautioned credit unions to take precautions against BEC attacks.
BEC attacks involve the sending of messages that impersonate a company/CU official and often request the urgent payment of funds, resulting in fraudulent wire transfers or checks, or other personal information that will also lead to loss of funds. Scammers typically steal the email credentials of a top executive through phishing or other methods.
In the FBI report, Donna Gregory, who leads the FBI’s Internet Crime Complaint Center (IC3), said the types of BEC fraud seen in 2019 weren’t particular new, but criminals have turned to new tactics and techniques. In particular, Gregory said the more sophisticated attacks make it more difficult than ever to spot the difference between a fake or a real email.
BEC Vs. Ransomware
According to the FBI, overall, the IC3 received 467,361 reports of Internet-related crimes in 2019, with the FBI receiving nearly 24,000 complaints about BEC scams over the same time period, with a total estimated loss of $1.7 billion and an average loss of about $72,000.
That compares to 2,047 ransomware attacks reported to the FBI last year led to losses of about $8.9 million, the report indicates.
In the newest report the FBI said it has seen in increase in fraud that targets payroll funds in order to divert that money.
"In this type of scheme, a company's human resources or payroll department receives an email appearing to be from an employee requesting to update their direct deposit information for the current pay period," the IC3 report states. "The new direct deposit information generally routes to a pre-paid account."
The full report can be found here.